Brazil does not have full control over the majority of the data belonging to its businesses and citizens. What resides outside the country or under the control of foreign providers is, to some extent, outside our sovereignty. And this is not a figure of speech: it includes Pix data, SUS health records, and flight boarding control systems. This is not a hypothetical scenario. It is the description of the current reality.
More than 60% of Brazil's digital workload is processed and stored abroad, largely on servers owned by American Big Techs. These servers are subject to the Cloud Act, a 2018 American law that authorizes the United States government to demand access to data regardless of where it is physically hosted, and to Section 702 of FISA, the foreign surveillance law that expands this access in intelligence contexts. In 2024, Brazil recorded a deficit of US$ 7.1 billion in the telecommunications and computing sector, driven directly by this dependence.
The question this article intends to answer is not just "what is wrong." It is why we got here, what this means in practice, and what is being done — and what is still missing — to change this scenario.
What it means to have more than 60% of Brazilian data outside Brazil
"Cloud" is not a place in the sky. It is someone's data center, somewhere in the world. When a company hires cloud computing services from AWS, Google Cloud, or Microsoft Azure, it is using the physical infrastructure of these companies — servers located in specific countries, subject to the laws of those countries.
Brazil, like most developing economies, built its digital dependence on this foreign infrastructure. More than 60% of Brazilian data processing and storage happens outside the national territory. This means that financial transaction data, health records, government operation logs, and national business information are on servers that Brazil does not operate, does not directly regulate, and over which it does not exercise full sovereign control.
The practical consequence is concrete. Any data stored on servers of American companies can be accessed by the United States government via legal request, regardless of where that server is physically located. It is not necessary for the server to be on American soil. It is sufficient that the company operating it is American.
The Cloud Act and FISA: what they are and why they affect Brazil
The Cloud Act, Clarifying Lawful Overseas Use of Data Act, approved in 2018, obliges United States companies to hand over data in their custody to the American government upon court order, regardless of the country where that data is stored. The law arose to resolve a previous legal impasse, but in practice, it created broad extraterritoriality over any data hosted on the infrastructure of companies such as AWS, Google, and Microsoft.
Section 702 of FISA, the Foreign Intelligence Surveillance Act, goes further. It allows American intelligence agencies to request user data without public oversight and without the possibility of refusal by companies, in contexts classified as national security. This mechanism operates with less transparency and fewer legal resources than a conventional judicial request.
Brazil has legislation with extraterritorial reach — the LGPD, General Personal Data Protection Law, applies to any processing of data belonging to Brazilian citizens, wherever it happens. The real challenge is not the absence of a norm. It is the ability to exercise it in practice when the data resides in infrastructure controlled by another sovereignty.
Why we got here: cost, capacity, and choices
The simple answer is cost. The complete answer is cost plus lack of installed capacity — and this distinction matters for understanding what needs to change.
Hiring data processing in Brazil is up to 60% more expensive than in the United States. Two factors explain most of this difference: heavy taxation on imported technology equipment and the cost of electricity. Data centers are large consumers of energy, not only to power the servers but for the cooling system that keeps them operating. Brazil has one of the cleanest energy matrices in the world, with a high share of renewable sources, but the cost of this energy, combined with the tax structure on equipment imports, makes operating a data center in Brazil significantly more expensive than in other countries.
This cost differential explains much of the historical decisions by Brazilian companies to hire infrastructure abroad. It is a spreadsheet decision, made individually by each organization. The problem is that the sum of these individual decisions created a structural dependence that transcends the organizations that compose it.
The capacity deficit: space, people, processes, and technology
But cost, by itself, does not tell the whole story. If tomorrow all Brazilian companies and public bodies decided to repatriate their data — bringing everything to servers on national soil — would there be a place to put it? Would there be professionals to operate this infrastructure? Would Brazil have the installed capacity to support this demand?
The honest answer is no. And this is as relevant as the cost.
Brazil entered 2025 with a projected deficit of 530,000 IT professionals. It is not just physical servers that are missing: there is a lack of trained people to operate them, organizational processes to manage them, and national technology at a sufficient scale to support them. Data sovereignty depends on a complete chain — physical space, energy, professionals, processes, and governance — that Brazil has not yet built on the necessary scale.
The decision to use infrastructure outside Brazil or foreign service providers is, before being a matter of sovereignty, a decision of spreadsheet and service availability. This is the honest starting point for any debate on how to change this scenario.
Residency is not sovereignty
Here is a misunderstanding that needs to be cleared up: having a data center on Brazilian soil does not, in itself, guarantee sovereignty over the data stored in it.
If the data center is operated by an American company — AWS, Google, Microsoft — the data it hosts remains subject to the Cloud Act. Jurisdiction over data is not defined by the server's address, but by the nationality of the company that controls it. Having the server in Brazil but the access key in the hands of an American company is like renting a house where the landlord holds the only set of spare keys: the occupation is yours, but the access is not exclusively yours.
Real data sovereignty, therefore, requires two combined elements: data within the national territory and cryptographic control in the hands of a Brazilian entity or under exclusively Brazilian jurisdiction. One without the other does not complete the equation.
REDATA: a concrete movement that still needs to become law
REDATA, the Special Taxation Regime for Data Centers, is the Brazilian government's most concrete response to the digital infrastructure deficit. Approved as a provisional measure, the program offers subsidies and tax exemptions for companies that build or expand data centers in Brazil, with trade-offs: part of the processing capacity must be allocated to the Brazilian market, the operation must meet energy sustainability requirements, and, in its most advanced conception, the program encourages cryptographic control of data by national entities.
REDATA is a move in the right direction. But it has a limit: approved as a provisional measure, it needs to be converted into permanent law to generate the effect it promises. Short-term tax incentives do not justify the investment cycles required to build data centers at scale. No company builds ten-year infrastructure based on a measure that might not be renewed. The conversion into permanent law is not a bureaucratic detail: it is the condition for REDATA to become a real vector of structural change.
A vulnerability that requires collective awareness, not just regulation
Brazil has legislation. It has the LGPD, which establishes legal bases for the processing of personal data and has recognized extraterritorial reach. It has the ANPD, the National Data Protection Authority, with growing regulatory and sanctioning power. The real challenge is not the absence of a norm. It is the distance between what the law states and what is possible to exercise in practice when data is under another sovereignty's jurisdiction.
This does not invalidate the legislation. It invalidates the illusion that legislating is sufficient.
Data sovereignty is not a declaration. It is a project. It requires physical infrastructure, human capacity, organizational governance, and coordinated public policy. None of these elements are built overnight, and none of them solve the problem in isolation.
Collective awareness of this vulnerability is, itself, part of the solution. Organizations that understand what it means to store critical data in infrastructure under foreign jurisdiction make different choices — regarding architecture, hiring, and investment in internal capacity. Public and private managers who understand what the Cloud Act means in practice prioritize the issue differently.
Data sovereignty is not declared. It is built. And construction begins by knowing where we are.
Frequently asked questions about data sovereignty in Brazil
What is data sovereignty? Data sovereignty is a country's ability to exercise effective control over the data generated in its territory or by its citizens and organizations, ensuring that this data is subject to national laws and out of reach of other jurisdictions without consent. This involves both the physical location of servers and the cryptographic and legal control over who can access the data.
What is the Cloud Act and how does it affect Brazil? The Cloud Act, Clarifying Lawful Overseas Use of Data Act, is a 2018 American law that obliges United States companies to hand over data in their custody to the American government, regardless of where that data is physically stored. This means that data stored on servers of AWS, Google, or Microsoft — even if located in Brazil — can be accessed by the American government via a court order in the United States, without the need for authorization from Brazilian authorities.
Why is more than 60% of Brazilian data outside Brazil? The primary reason is cost. Processing and storing data in Brazil is up to 60% more expensive than in the United States, due to heavy taxation on imported technology equipment and the cost of electricity. Added to this are decades of business decisions that prioritized the lowest immediate cost, in addition to the absence of sufficient national installed capacity, both in physical infrastructure and IT professionals.
What is REDATA? REDATA is the Special Taxation Regime for Data Centers, a Brazilian government program that offers tax exemptions for companies that build or expand data centers in Brazil. In return, companies must allocate part of the processing capacity to the Brazilian market, meet energy sustainability requirements and, in its most complete version, ensure cryptographic control of data by Brazilian entities. REDATA was approved as a provisional measure and needs to be converted into permanent law to generate the structural effect it promises.
Does having a data center in Brazil guarantee data sovereignty? Not necessarily. Data sovereignty depends on two combined factors: the physical location of the servers and the legal and cryptographic control over the stored data. If the data center located in Brazil is operated by an American company, the data it hosts remains subject to the Cloud Act. Server location alone does not define jurisdiction over the data.
What is the IT professional deficit in Brazil and why does it matter for data sovereignty? Brazil entered 2025 with a projected deficit of 530,000 IT professionals. This number matters for data sovereignty because building and operating national digital infrastructure at scale requires not just physical servers, but qualified teams to manage them. Dependence on foreign infrastructure is not just a matter of cost: it is also the result of a lack of human and technological installed capacity to support a transition toward greater digital autonomy.
Knowing where we are is the first step
The debate on data sovereignty in Brazil does not start with technology. It starts with an honest diagnosis of where we are and why we got here.
More than 60% of Brazilian data outside Brazil. A deficit of US$ 7.1 billion in the telecommunications and computing sector in 2024. An American law that reaches our data regardless of where it is. A deficit of 530,000 IT professionals. A tax incentive regime that needs to become law to become state policy.
This is the starting point. Not as paralysis, but as clarity. Data sovereignty is not an abstract aspiration. It is a set of practical decisions — of investment, public policy, people training, organizational governance — that need to be made with awareness of the real scenario.
Sovereignty is not declared. It is built. And building requires knowing where we are before deciding where to go.
About the Author
Consuelo Rodrigues is a specialist in data governance, data protection, privacy, and artificial intelligence governance. Co-founder of Privacidade+, she is a certified DPO and Lead Auditor for ISO/IEC 27001, 27701, and 42001 standards. She was appointed Ethical Data & AI Governance Advisor to the Presidency of DAMA Brazil for the 2026-2028 mandate. She works at Keyrus on Data and AI Governance projects for medium and large-sized organizations. With over 30 years of IT experience, she has worked for highly regulated pharmaceutical multinationals and is a graduate of the MBA program at Fundação Dom Cabral.